Secure Configuration

Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?

Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?

Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?

Do you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?

If yes to question A5.4, which authentication option do you use?

Describe the process in place for changing passwords on your external services when you believe they have been compromised.

When not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?

Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?

When a device requires a user to be present, do you set a locking mechanism on your devices to access the software and services installed?

Which method do you use to unlock the devices?